This invention relates to computer network security, and more particularly to methods and apparatus for securing one or more nodes on a computer network.
Conventional network security systems can be said to provide either “active” or “passive” protection. Active security systems provide real-time barriers to intrusions, via software- or hardware-based pre-programmed intrusion detection measures. “Passive” systems provide the ability to detect and recover from previously observed security breaches, by examining data gathered about previous system access activity, so as to improve static access controls and policies over time. Active systems, then, function primarily to prevent intrusions, and passive systems function primarily to report on and examine data about previous intrusions to prevent future intrusions.
Examples of conventional active security systems include access control tools, content filtering tools, and system auditing tools. Access control tools, such as network firewalls, can be deployed on dedicated machines, usually at a network perimeter, to control inbound and outbound access using pre-configured permission levels. Content filtering tools, like computer virus scanners, typically execute on either an e-mail server or a workstation, and function by screening incoming content, like e-mail and attached files, for potentially threatening matter, based on known signatures of previously observed attacks. System auditing tools, like reference monitors, may provide either stateless or state-based monitoring (such as the state-based monitoring provided by the stateful reference monitor described in U.S. patent application Ser. No. 10/071,328 and incorporated by reference herein) of individual workstations or servers, by identifying variations from either pre-determined settings or a dynamic machine state.
Examples of conventional passive security systems include activity logging tools and auditing tools, which may be employed in conjunction with one another. Activity logging tools track the activity of one or more computers and transcribe observed system activity to a series of log files as individual entries. Auditing tools typically examine those log entries to discern breaches, attacks, or other potentially threatening activity, occurring either across machines or within individual machines.
Both types of security systems provide useful intrusion detection and prevention functions. However, both generally rely on pre-programmed network administration policy, business rules, or other parameters, and so neither (particularly passive systems) provides the adaptation capability sometimes necessary to counter novel types of attacks as they occur. Also, conventional active systems are unable to observe and correlate seemingly innocuous activity as it occurs across nodes to determine that an intrusion is in progress. Given the growing ubiquity of computer networks and the value of electronic assets, commensurate growth of network security threats is to be expected. Therefore, a security system which provides adaptive countermeasures in real time to localized (i.e., limited to one node) or non-localized intrusions would provide tremendous value to operators of computer networks.